PCI DSS Compliance

Introduction

PCI DSS is a set of security standards mandated by the payment card networks (Visa, Mastercard, etc.) and managed by the PCI Security Standards Council (PCI SSC), designed to protect cardholder data.

What is PCI DSS v4.0?

PCI DSS applies to all entities involved in payment card processing — including merchants, processors, acquirers, and service providers. It lists 12 detailed control requirements grouped into 6 logical security goals.

Benefits of PCI DSS v4.0 Certification

• Protects cardholder data and reduces vulnerability to breaches
• Reduces exposure to card-network fines and bank penalties after a security incident
• Builds buyer trust in your checkout and payment processing gateway
• Satisfies contractual requirements of acquiring banks and payment gateways
• Provides a clear security structure for handling financial transaction data

Who Needs PCI DSS v4.0 Certification?

• E-commerce merchants accepting credit cards
• Payment gateway providers and processors
• Fintech platforms handling card data
• Call centres and BPOs processing payments
• Banks and financial service entities

PCI DSS v4.0 Requirements

• Install and maintain network security controls (Requirement 1)
• Apply secure configurations to all system components (Requirement 2)
• Protect stored account data (Requirement 3)
• Encrypt cardholder data during transmission (Requirement 4)
• Protect systems against malware (Requirement 5)
• Develop and maintain secure software and systems (Requirement 6)
• Restrict data access by business need-to-know (Requirement 7)
• Identify users and authenticate access — MFA (Requirement 8)
• Restrict physical access to cardholder data (Requirement 9)
• Log and monitor all access to system components (Requirement 10)
• Test security of systems and networks regularly (Requirement 11)
• Support information security with organisational policy (Requirement 12)

PCI DSS v4.0 Certification Process

Documents Required

• Information Security Policy
• Statement of Applicability or Scope document
• Network topology diagram and data flow map
• Vulnerability scanning reports (ASV)
• Penetration testing reports
• Access logs and administrative approvals

PCI DSS v4.0 Certification Cost

We don’t publish a fixed price, because cost depends on organisation size, number of locations, scope, process complexity, audit duration, consulting requirements and certification body fees. Request a scoped estimate and we’ll walk you through each factor.

Certification Timeline

Timelines depend on organisational readiness, scope and the complexity of your processes. A well-prepared, single-site organisation typically moves faster than a multi-site or highly regulated one — we’ll give you a realistic timeline after the initial gap analysis.

PCI DSS vs ISO 27001

ISO 27001 is a broad information security management framework covering the entire organisation. PCI DSS is highly technical and specific, focusing exclusively on protecting cardholder data within the Cardholder Data Environment (CDE).

Frequently Asked Questions